github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-08-27 20:18:57 +00:00
Code Issues Projects Releases Wiki Activity

runtime: refactor hypervisor devices cgroup creation

Browse Source 
Separatly added hypervisor devices to cgroup to
omit not relevant warnings and fail if none of them
are available.
Fixes #6656

Signed-off-by: Balint Tobik <btobik@redhat.com>
This commit is contained in:
Balint Tobik 2025-04-08 14:20:49 +02:00
parent f04bb3f34c
commit a4d3f813c2
1 changed files with 30 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
src/runtime/pkg/resourcecontrol/cgroups.go
View File

@ -8,6 +8,7 @@
package resourcecontrol package resourcecontrol
import ( import (
"errors"
"fmt" "fmt"
"os" "os"
"path/filepath" "path/filepath"
@ -50,7 +51,7 @@ type LinuxCgroup struct {
sync.Mutex sync.Mutex
} }
func sandboxDevices() []specs.LinuxDeviceCgroup { func sandboxDevices() ([]specs.LinuxDeviceCgroup, error) {
devices := []specs.LinuxDeviceCgroup{} devices := []specs.LinuxDeviceCgroup{}
defaultDevices := []string{ defaultDevices := []string{
@ -68,14 +69,33 @@ func sandboxDevices() []specs.LinuxDeviceCgroup {
// In order to run Virtual Machines and create virtqueues, hypervisors // In order to run Virtual Machines and create virtqueues, hypervisors
// need access to certain character devices in the host, like kvm and vhost-net. // need access to certain character devices in the host, like kvm and vhost-net.
hypervisorDevices := []string{ hypervisorDevices := []string{
"/dev/kvm", // To run virtual machines with KVM "/dev/kvm", // To run virtual machines with KVM
"/dev/mshv", // To run virtual machines with Hyper-V "/dev/mshv", // To run virtual machines with Hyper-V
}
virtualDevices := []string{
"/dev/vhost-net", // To create virtqueues "/dev/vhost-net", // To create virtqueues
"/dev/vfio/vfio", // To access VFIO devices "/dev/vfio/vfio", // To access VFIO devices
"/dev/vhost-vsock", // To interact with vsock if "/dev/vhost-vsock", // To interact with vsock if
} }
defaultDevices = append(defaultDevices, hypervisorDevices...) hypervisorDeviceAdded := false
for _, hypervisor := range hypervisorDevices {
hypervisorDevice, err := DeviceToLinuxDevice(hypervisor)
if err != nil {
if !os.IsNotExist(err) {
controllerLogger.WithField("source", "cgroups").Warnf("Failed to add %s to the devices cgroup: %v", hypervisor, err)
}
continue
}
devices = append(devices, hypervisorDevice)
hypervisorDeviceAdded = true
controllerLogger.WithField("source", "cgroups").Infof("Adding %s to the devices cgroup", hypervisor)
break
}
if !hypervisorDeviceAdded {
return []specs.LinuxDeviceCgroup{}, errors.New("Could not add any hypervisor device to devices cgroup")
}
defaultDevices = append(defaultDevices, virtualDevices...)
for _, device := range defaultDevices { for _, device := range defaultDevices {
ldevice, err := DeviceToLinuxDevice(device) ldevice, err := DeviceToLinuxDevice(device)
@ -128,7 +148,7 @@ func sandboxDevices() []specs.LinuxDeviceCgroup {
devices = append(devices, wildcardDevices...) devices = append(devices, wildcardDevices...)
return devices return devices, nil
} }
func NewResourceController(path string, resources *specs.LinuxResources) (ResourceController, error) { func NewResourceController(path string, resources *specs.LinuxResources) (ResourceController, error) {
@ -168,7 +188,11 @@ func NewResourceController(path string, resources *specs.LinuxResources) (Resour
func NewSandboxResourceController(path string, resources *specs.LinuxResources, sandboxCgroupOnly bool) (ResourceController, error) { func NewSandboxResourceController(path string, resources *specs.LinuxResources, sandboxCgroupOnly bool) (ResourceController, error) {
sandboxResources := *resources sandboxResources := *resources
sandboxResources.Devices = append(sandboxResources.Devices, sandboxDevices()...) sandboxDevices, err := sandboxDevices()
if err != nil {
return nil, err
}
sandboxResources.Devices = append(sandboxResources.Devices, sandboxDevices...)
// Currently we know to handle systemd cgroup path only when it's the only cgroup (no overhead group), hence, // Currently we know to handle systemd cgroup path only when it's the only cgroup (no overhead group), hence,
// if sandboxCgroupOnly is not true we treat it as cgroupfs path as it used to be, although it may be incorrect. // if sandboxCgroupOnly is not true we treat it as cgroupfs path as it used to be, although it may be incorrect.